# OWASP Risk Mapping > Mapping ACS controls to the OWASP Top 10 for Agentic Applications (2026) - **Category**: guardrails-acs - **Canonical URL**: https://designpattern.fyi/guardrails-acs/owasp-risk-mapping/ --- ## Description Mapping ACS controls to the OWASP Top 10 for Agentic Applications (2026) ## Additional Notes # Mapping ACS Controls to the OWASP Top 10 for Agentic Applications (2026) This is the part that turns ACS from an abstract architecture into an actual guardrails program: which control addresses which cataloged risk. The ten risks below (ASI01–ASI10) are OWASP's; the mapping to ACS controls is this guide's synthesis, meant as a starting point for your own risk-to-control matrix. --- ## The Risk-to-Control Mapping | Risk | One-line definition | Primary ACS control(s) | How it helps | |---|---|---|---| | **ASI01** — Agent Goal Hijack | Attacker-supplied content redirects the agent's objective | User Message hook, Knowledge Retrieval hook, Guardian Agent policy | Every piece of inbound content is treated as untrusted at the point it enters context, giving the Guardian Agent a chance to deny or rewrite it before the planner acts on it | | **ASI02** — Tool Misuse & Exploitation | A legitimate tool is used in an unsafe or unintended way | Tool Call Request hook | Every tool call is evaluated against policy before it executes; the Guardian Agent can deny it or narrow the parameters | | **ASI03** — Agent Identity & Privilege Abuse | The agent operates with more privilege than intended, or inherits a user's identity | Tier 3 enterprise classifiers, Trace identity fields, the emerging identity workstream | Runtime enforcement plus an audit trail that ties each action to a specific, scoped identity rather than a borrowed session | | **ASI04** — Agentic Supply Chain Vulnerabilities | New tools, MCP servers, or dependencies discovered at runtime introduce risk | Inspect / dynamic AgBOM, MCP Outbound hook | Every new component the agent adopts is captured in the AgBOM and can be checked against policy; the outbound MCP hook can gate connections to unapproved servers | | **ASI05** — Unexpected Code Execution | Natural-language paths trigger unintended code execution | Tool Call Request hook (for code-exec/OS tools), Tier 3 classifiers | Code-execution calls pass through the same allow/deny/modify gate as any other tool call | | **ASI06** — Memory & Context Poisoning | Long-term memory or retrieved content is manipulated to reshape future behavior | Memory Context Retrieval, Memory Store, Knowledge Retrieval hooks | Both the write path and the read path for memory and knowledge are inspectable and individually gate-able | | **ASI07** — Insecure Inter-Agent Communication | Spoofed or manipulated messages between agents in a multi-agent system | A2A hooks | Delegation, cancellation, and status messages all pass through the Guardian Agent for authentication and authorization | | **ASI08** — Cascading Failures | An error or compromise in one agent propagates through a connected system | Trace (OpenTelemetry/OCSF), A2A hooks | A full cross-agent trace makes propagation visible in near real time; hooks let you contain a failing agent before it fans out further | | **ASI09** — Human-Agent Trust Exploitation | Confident, polished agent output manipulates a human into an unsafe approval | Agent Response hook | The Guardian Agent can flag, modify, or hold a response that matches a risk pattern before a human ever sees it | | **ASI10** — Rogue Agents | An agent operates outside policy through compromise, drift, or design failure | The full Instrument + Trace + Inspect stack | The closest thing ACS offers to a kill switch: deny at any hook, reconstruct behavior from trace, and pull a compromised component from the AgBOM | --- ## Detailed Analysis by Risk ### ASI01 — Agent Goal Hijack **The Risk:** Attacker-supplied content redirects the agent's objective **ACS Controls:** - **User Message hook** — filters inbound prompts for injection patterns - **Knowledge Retrieval hook** — screens retrieved content for manipulative instructions - **Guardian Agent policy** — evaluates context for goal-redirection attempts **How It Helps:** Every piece of inbound content is treated as untrusted at the point it enters context. The Guardian Agent can: - **Deny** obviously malicious inputs - **Modify** suspicious inputs to remove injection attempts - **Allow** clean inputs to proceed **Implementation Notes:** - Start with known injection patterns (prompt injection, jailbreaks) - Add policy rules for out-of-scope topic detection - Monitor for false positives in legitimate user requests --- ### ASI02 — Tool Misuse & Exploitation **The Risk:** A legitimate tool is used in an unsafe or unintended way **ACS Controls:** - **Tool Call Request hook** — evaluates tool calls before execution - **Parameter inspection** — checks tool parameters, not just tool names - **Tier 3 classifiers** — industry-specific tool usage rules **How It Helps:** Every tool call is evaluated against policy before it executes: - **Deny** high-risk calls (e.g., database deletion without approval) - **Modify** parameters to narrow scope (e.g., limit query results) - **Allow** safe calls to proceed **Implementation Notes:** - Don't just inspect tool names — check parameters - Implement parameter-level validation for high-impact tools - Require approval for destructive actions --- ### ASI03 — Agent Identity & Privilege Abuse **The Risk:** The agent operates with more privilege than intended, or inherits a user's identity **ACS Controls:** - **Tier 3 enterprise classifiers** — organizational identity and access rules - **Trace identity fields** — audit trail tying actions to specific identities - **Emerging identity workstream** — non-human agent authentication **How It Helps:** Runtime enforcement plus an audit trail: - **Enforce** scoped identities per agent or session - **Track** which identity performed each action - **Audit** privilege usage patterns over time **Implementation Notes:** - Implement just-in-time access credentials - Use scoped identities rather than borrowing user sessions - Monitor for privilege escalation patterns --- ### ASI04 — Agentic Supply Chain Vulnerabilities **The Risk:** New tools, MCP servers, or dependencies discovered at runtime introduce risk **ACS Controls:** - **Inspect / dynamic AgBOM** — tracks all agent components - **MCP Outbound hook** — gates connections to MCP servers - **Component approval policy** — checks new components against allow-lists **How It Helps:** Every new component is captured and checked: - **Detect** when an agent connects to a new MCP server - **Block** connections to unapproved servers - **Audit** component changes over time **Implementation Notes:** - Maintain an approved component list - Implement real-time AgBOM updates - Require approval for new MCP server connections --- ### ASI05 — Unexpected Code Execution **The Risk:** Natural-language paths trigger unintended code execution **ACS Controls:** - **Tool Call Request hook** — applies to code-execution tools - **Tier 3 classifiers** — industry-specific code execution rules - **Parameter validation** — inspects generated code before execution **How It Helps:** Code-execution calls pass through the same gate as other tools: - **Deny** obviously malicious code - **Modify** code to add safety checks - **Require approval** for high-risk operations **Implementation Notes:** - Treat code-execution tools as high-risk - Implement sandboxing for code execution - Require human approval for system-level operations --- ### ASI06 — Memory & Context Poisoning **The Risk:** Long-term memory or retrieved content is manipulated to reshape future behavior **ACS Controls:** - **Memory Context Retrieval hook** — screens memory reads - **Memory Store hook** — screens memory writes - **Knowledge Retrieval hook** — screens knowledge source access **How It Helps:** Both read and write paths are inspectable: - **Block** poisoned content from being written to memory - **Screen** memory reads for suspicious patterns - **Audit** memory access patterns over time **Implementation Notes:** - Gate both write and read paths - Implement memory content validation - Consider one-time memory audits for existing data --- ### ASI07 — Insecure Inter-Agent Communication **The Risk:** Spoofed or manipulated messages between agents in a multi-agent system **ACS Controls:** - **A2A hooks** — task delegation, cancellation, status messages - **Authentication policies** — verify agent identities - **Authorization rules** — enforce inter-agent permissions **How It Helps:** All inter-agent communication passes through Guardian Agent: - **Authenticate** message sources - **Authorize** task delegations - **Audit** inter-agent communication patterns **Implementation Notes:** - Implement agent-to-agent authentication - Define authorization rules for task delegation - Monitor for suspicious communication patterns --- ### ASI08 — Cascading Failures **The Risk:** An error or compromise in one agent propagates through a connected system **ACS Controls:** - **Trace (OpenTelemetry/OCSF)** — cross-agent observability - **A2A hooks** — contain failing agents - **Circuit breaker policies** — stop propagation **How It Helps:** Full cross-agent trace plus containment: - **Detect** failure propagation in real time - **Contain** failing agents before they affect others - **Reconstruct** failure chains for post-mortem analysis **Implementation Notes:** - Implement circuit breakers for agent interactions - Monitor for error propagation patterns - Define containment policies for different failure modes --- ### ASI09 — Human-Agent Trust Exploitation **The Risk:** Confident, polished agent output manipulates a human into an unsafe approval **ACS Controls:** - **Agent Response hook** — screens outbound responses - **Risk pattern detection** — identifies manipulative content - **Response modification** — adds warnings or holds suspicious responses **How It Helps:** Guardian Agent can intervene before human sees response: - **Flag** responses that match risk patterns - **Modify** responses to add safety warnings - **Hold** responses requiring human review **Implementation Notes:** - Implement response risk scoring - Define patterns for manipulative content - Require human approval for high-risk responses --- ### ASI10 — Rogue Agents **The Risk:** An agent operates outside policy through compromise, drift, or design failure **ACS Controls:** - **Full Instrument + Trace + Inspect stack** — complete visibility - **Deny at any hook** — kill switch capability - **AgBOM component removal** — disable compromised components **How It Helps:** The closest thing ACS offers to a kill switch: - **Deny** actions at any hook point - **Reconstruct** behavior from trace data - **Remove** compromised components from AgBOM **Implementation Notes:** - Implement emergency stop procedures - Maintain trace data for incident response - Define component revocation processes --- ## Building Your Risk-to-Control Matrix This mapping is a starting point. Build your own matrix by: 1. **Assess your agent estate** — which ASI risks are most plausible given what your agents do? 2. **Prioritize hook coverage** — focus on controls that address your highest-risk scenarios 3. **Map to regulatory requirements** — connect ASI risks to compliance obligations 4. **Test and validate** — verify controls effectively mitigate identified risks 5. **Iterate and update** — refine the matrix as your agent estate evolves --- ## Key Takeaways 1. **ACS provides controls for all ASI risks** — each OWASP risk maps to specific ACS hooks and policies 2. **Instrument provides the control points** — hooks at every decision point enable risk mitigation 3. **Trace provides the evidence** — audit trails support incident response and compliance 4. **Inspect provides the inventory** — AgBOM tracks components that could introduce risk 5. **Build your own matrix** — use this mapping as a starting point for your risk-to-control analysis --- ## Next Steps - **Implementation Guide** — follow the step-by-step process to implement controls for your risks - **Governance Checklist** — assess your maturity in addressing ASI risks